As you might have learned with respect to the は in the phrase, the Japanese language, and specifically its grammar, is driven by a system of particles. In this case, you have probably yet to learn that there is a particle that corresponds to questions. This is the か particle, and is placed at the end of a sentence or phrase that is meant to be a question. Consider its use to be similar, but not exactly the same, as using a question mark in the English language, and it is voiced.
The か particle transforms a statement into a question, like so:
This is your pencil.
Is this your pencil?
Note that all that changed was the addition of the か particle at the end.
In the case of your not-yet-a-question statement, you'll need to do the same:
Who did it?
This is technically ungrammatical, so you'll need another particle here: the が particle. This particle generally marks the direct subject of the sentence. In this phrase, it replaces the は particle (which can be considered a "topic" particle). Question words in question sentences are automatically the explicit focus of the sentence, so they take the が particle instead of は, when asking a question.
Putting it all together, then we have:
Who did it?
Now this sentence is grammatically correct. There are still more natural ways to express this question, especially depending on the context you'd be asking it in, but without a little more studying from your part, this is as good as this will get.